56 - Cover session invalidation and fix pest-browser path handling

shell.nix

@@ -109,7 +109,35 @@ pkgs.mkShell {
     pest-browser() {
       # Run Pest browser tests (Playwright) on the host. Pass --headed for a
       # visible browser or --debug to pause on failure. Requires `npm run build`.
+      # A path argument replaces the default suite; flags alone keep it.
+      # Only existing paths count, so `--filter Logout` cannot silently
+      # unscope the run to the whole test directory.
+      local has_path=0
+      local skip_next=0
+      local arg
+      for arg in "$@"; do
+        if [ "$skip_next" -eq 1 ]; then
+          skip_next=0
+          continue
+        fi
+        case "$arg" in
+          --filter|--group|--exclude-group|--test-suffix)
+            skip_next=1
+            ;;
+          -*) ;;
+          *)
+            if [ -e "$arg" ]; then
+              has_path=1
+            fi
+            ;;
+        esac
+      done
+
+      if [ "$has_path" -eq 1 ]; then
+        vendor/bin/pest "$@"
+      else
         vendor/bin/pest tests/Browser "$@"
+      fi
     }
     
     dev-fix-permissions() {

tests/Feature/AuthenticationTest.php

@@ -90,4 +90,21 @@ public function test_users_can_logout(): void
         $response->assertRedirect('/');
         $this->assertGuest();
     }
+
+    public function test_logout_invalidates_the_session(): void
+    {
+        $user = Planner::factory()->create();
+
+        // Boots the session store so getId() below reflects a real value.
+        $this->actingAs($user)->get('/dashboard');
+
+        session()->put('scratch', 'value');
+
+        $sessionId = session()->getId();
+
+        $this->actingAs($user)->post('/logout');
+
+        $this->assertNotSame($sessionId, session()->getId());
+        $this->assertFalse(session()->has('scratch'));
+    }
 }